Re: [PATCH v4 2/5] iommu/dma: Catch scatterlist length overflows

On 29/07/2026 1:07 pm, Sebastian Brzezinka wrote:
> Hi,
> On Thu Jul 23, 2026 at 12:25 PM CEST, Krzysztof Karas wrote:
>> It is possible, when a very large mapping uses only one
>> scatterlist, that padding overflows scatterlist's length field.
>> This results in:
>>   1) silently wrapping the value
>>   2) smaller than desired mappings produced by iommu_map_sg
>>   3) leaving mapped bytes in memory (no iommu_unmap)
>>
>> Address this issue by adding overflow detection for scatterlist
>> length field.
>>
>> Fixes: 809eac54cdd6 ("iommu/dma: Implement scatterlist segment merging")
>> Signed-off-by: Krzysztof Karas <[email protected]>
>> Reviewed-by: Robin Murphy <[email protected]>
>> ---
>> v4:
>>   * Added value wrap check before s->length assignment (Robin);
>>
>>   drivers/iommu/dma-iommu.c | 20 +++++++++++++++++++-
>>   1 file changed, 19 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
>> index 381b60d9e7ce..3ca3196a41b0 100644
>> --- a/drivers/iommu/dma-iommu.c
>> +++ b/drivers/iommu/dma-iommu.c
>> @@ -21,6 +21,7 @@
>>   #include <linux/iommu-dma.h>
>>   #include <linux/iova.h>
>>   #include <linux/irq.h>
>> +#include <linux/limits.h>
>>   #include <linux/list_sort.h>
>>   #include <linux/memremap.h>
>>   #include <linux/mm.h>
>> @@ -1477,6 +1478,12 @@ int iommu_dma_map_sg(struct device *dev, struct scatterlist *sg, int nents,
>>   		sg_dma_len(s) = s_length;
>>   		s->offset -= s_iova_off;
>>   		s_length = iova_align(iovad, s_length + s_iova_off);
>> +		if ((s_length & UINT_MAX) == 0) {
> Might be better to go with  s_length > UINT_MAX . Right now it's 64 &
> 32, so only the lower bits count. Or just ignore this comment  it if
> it's intended.

Yes, this code also needs to support 32-bit size_t, wherein the overflow 
already happens within the calculation of s_length itself.

Thanks,
Robin.